mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
ruvnet
84737f13ae
`shell: true` was unconditional, and the probed binary comes from `process.env.AGENTBBS_BIN`. Under a shell that argument is command-interpreted, so `AGENTBBS_BIN='agentbbs --version; touch /tmp/PWNED'` executes the trailing command. Verified locally: the file is created with `shell: true` and the spawn fails with ENOENT once the shell is gated off. This is the case browser-tools.ts already warns about in the comment beside the same pattern -- "if user-controlled args are ever added, escape them before spawn" -- and `shell: process.platform === 'win32'` is the convention already used at browser-tools.ts:49, commands/init.ts:856 and :1194, and init/helpers-generator.ts:1459. Unconditional `shell: true` appeared nowhere else in the package. The Windows behaviour the original was reaching for is unchanged: cmd.exe still resolves the `agentbbs.cmd` shim via PATHEXT. POSIX simply stops interpreting the override. Added windowsHide to match the sibling call sites. Verified the fix still does what it set out to do: with the CLI resolvable the suite is 12/12 and the four previously-always-skipped happy-path tests execute, with the shell disabled on POSIX. Co-Authored-By: RuFlo <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_013u4pmL9ZUAXb6usVQgNo67